Analysis
-
max time kernel
343s -
max time network
344s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 21:53
Behavioral task
behavioral1
Sample
sv.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
sv.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
sv.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
sv.exe
Resource
win11-20240508-en
Errors
General
-
Target
sv.exe
-
Size
63KB
-
MD5
c095a62b525e62244cad230e696028cf
-
SHA1
67232c186d3efe248b540f1f2fe3382770b5074a
-
SHA256
a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6
-
SHA512
5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0
-
SSDEEP
1536:unjFXblMp3wgDkbivVSm16KTOKjLIJXc:unrAwgDkbicmbOKj0JM
Malware Config
Extracted
xworm
amount-acceptance.gl.at.ply.gg:7420
-
Install_directory
%ProgramData%
-
install_file
svhost.exe
Signatures
-
Detect Xworm Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2324-1-0x0000000000950000-0x0000000000966000-memory.dmp family_xworm C:\ProgramData\svhost.exe family_xworm behavioral2/memory/2912-38-0x0000000000290000-0x00000000002A6000-memory.dmp family_xworm behavioral2/memory/964-40-0x0000000000EE0000-0x0000000000EF6000-memory.dmp family_xworm behavioral2/memory/2628-44-0x0000000001190000-0x00000000011A6000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3048 powershell.exe 2908 powershell.exe 2496 powershell.exe 2480 powershell.exe -
Drops startup file 2 IoCs
Processes:
sv.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk sv.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk sv.exe -
Executes dropped EXE 5 IoCs
Processes:
svhost.exesvhost.exesvhost.exesvhost.exesvhost.exepid process 2912 svhost.exe 964 svhost.exe 2948 svhost.exe 2628 svhost.exe 2528 svhost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
sv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe" sv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3048 powershell.exe 2908 powershell.exe 2496 powershell.exe 2480 powershell.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
sv.exepowershell.exepowershell.exepowershell.exepowershell.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exeshutdown.exedescription pid process Token: SeDebugPrivilege 2324 sv.exe Token: SeDebugPrivilege 3048 powershell.exe Token: SeDebugPrivilege 2908 powershell.exe Token: SeDebugPrivilege 2496 powershell.exe Token: SeDebugPrivilege 2480 powershell.exe Token: SeDebugPrivilege 2324 sv.exe Token: SeDebugPrivilege 2912 svhost.exe Token: SeDebugPrivilege 964 svhost.exe Token: SeDebugPrivilege 2948 svhost.exe Token: SeDebugPrivilege 2628 svhost.exe Token: SeDebugPrivilege 2528 svhost.exe Token: SeShutdownPrivilege 1048 shutdown.exe Token: SeRemoteShutdownPrivilege 1048 shutdown.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
sv.exepid process 2324 sv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
sv.exetaskeng.exedescription pid process target process PID 2324 wrote to memory of 3048 2324 sv.exe powershell.exe PID 2324 wrote to memory of 3048 2324 sv.exe powershell.exe PID 2324 wrote to memory of 3048 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2908 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2908 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2908 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2496 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2496 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2496 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2480 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2480 2324 sv.exe powershell.exe PID 2324 wrote to memory of 2480 2324 sv.exe powershell.exe PID 2324 wrote to memory of 1980 2324 sv.exe schtasks.exe PID 2324 wrote to memory of 1980 2324 sv.exe schtasks.exe PID 2324 wrote to memory of 1980 2324 sv.exe schtasks.exe PID 2668 wrote to memory of 2912 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2912 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2912 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 964 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 964 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 964 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2948 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2948 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2948 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2628 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2628 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2628 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2528 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2528 2668 taskeng.exe svhost.exe PID 2668 wrote to memory of 2528 2668 taskeng.exe svhost.exe PID 2324 wrote to memory of 1048 2324 sv.exe shutdown.exe PID 2324 wrote to memory of 1048 2324 sv.exe shutdown.exe PID 2324 wrote to memory of 1048 2324 sv.exe shutdown.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sv.exe"C:\Users\Admin\AppData\Local\Temp\sv.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\shutdown.exeshutdown.exe /f /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {EECC85B9-FE4F-4825-9DC2-A6E3F190F3D5} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\svhost.exeC:\ProgramData\svhost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svhost.exeC:\ProgramData\svhost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svhost.exeC:\ProgramData\svhost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svhost.exeC:\ProgramData\svhost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svhost.exeC:\ProgramData\svhost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svhost.exeFilesize
63KB
MD5c095a62b525e62244cad230e696028cf
SHA167232c186d3efe248b540f1f2fe3382770b5074a
SHA256a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6
SHA5125ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5a009a122ec9755af3e6ba958efd4fbbb
SHA19c0fa120e65f080a157db791269a6c677fd0b881
SHA256bf8e7a089b4f884c490596593ba06b56d5351f2eb412efcff58d9e48be572e36
SHA51256124d007f4ec8a55f334eaec6550dbecc508d363ea9aea82568de6001392ae1d6d8548668e41a9a4cb3031c6ac1e6a753de783ff95514a27af144a124f5f00c
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/964-40-0x0000000000EE0000-0x0000000000EF6000-memory.dmpFilesize
88KB
-
memory/2324-1-0x0000000000950000-0x0000000000966000-memory.dmpFilesize
88KB
-
memory/2324-0-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmpFilesize
4KB
-
memory/2324-31-0x000000001AAE0000-0x000000001AB60000-memory.dmpFilesize
512KB
-
memory/2324-32-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmpFilesize
4KB
-
memory/2324-33-0x000000001AAE0000-0x000000001AB60000-memory.dmpFilesize
512KB
-
memory/2324-41-0x000000001A6A0000-0x000000001A6AA000-memory.dmpFilesize
40KB
-
memory/2628-44-0x0000000001190000-0x00000000011A6000-memory.dmpFilesize
88KB
-
memory/2908-14-0x000000001B560000-0x000000001B842000-memory.dmpFilesize
2.9MB
-
memory/2908-15-0x00000000022C0000-0x00000000022C8000-memory.dmpFilesize
32KB
-
memory/2912-38-0x0000000000290000-0x00000000002A6000-memory.dmpFilesize
88KB
-
memory/3048-6-0x0000000002B60000-0x0000000002BE0000-memory.dmpFilesize
512KB
-
memory/3048-7-0x000000001B760000-0x000000001BA42000-memory.dmpFilesize
2.9MB
-
memory/3048-8-0x0000000001E70000-0x0000000001E78000-memory.dmpFilesize
32KB